# MCP tool catalogue

> Every tool an AI agent gets through a project's management MCP endpoint: what each one is for, whether it reads or changes the project, and its inputs.

[HTML version](https://snoozestack.com/docs/mcp-tools/) · [Docs index](https://snoozestack.com/llms.txt)

This is the complete list of tools an AI client is offered when it connects to a project's [management MCP endpoint](https://snoozestack.com/docs/mcp.md) — the answer to “what can the agent actually see and do?” before you hand it a token. Each entry says what the tool is for in plain terms and whether it only observes the project or changes it; the parameters and an example call are a click further down.

It is a list of **what the endpoint exposes to an agent**, not of everything snoozestack can do. Operations kept off it on purpose — deleting the project, inviting members, minting tokens — are covered under [what a token can't do](https://snoozestack.com/docs/mcp.md#scope). If it isn't on this page, an agent holding a token has no way to do it.

**How to read it**

Every tool carries one of three access types, the same annotation the endpoint sends to clients so they can confirm a deletion and not a read:

- **read** — only looks. Logs, the schema, the user list, analytics. Calling it changes nothing.
- **write** — creates or updates something: a schedule, a secret value, a bucket's visibility, an auth setting. Reversible by another change.
- **destroy** — removes something, and the endpoint offers no way to get it back. 15 of the tools are this kind; they are the ones to weigh before giving an agent a token for a project with real data.

The counts on the filter chips are the shape of the whole surface: of 80 tools, 40 only read. A token is scoped to one project, so every tool here acts on the project the token was made for and no other.

## Project

The project as a whole: its connection details, the publish history, and the logs and audit trail that say what has happened to it.

`project_info` read Connection details for this project: its API URL, publishable and service keys, primary website and auth settings. Start here when wiring an app to the project.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
project_info()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [organizations-projects-sources](https://snoozestack.com/docs/organizations-projects-sources.md) page — the same page an agent is pointed at in the tool's own description.

`logs_read` read Recent log output: "runtime" is the project's container (functions, auth, storage — one process, one log); "queues" and "sites" are the queue-trigger and website activity the portal logs for it.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `service` required | string | Which log to tail One of: `runtime`, `queues`, `sites` |
| `lines` | integer | How many lines (default 200, max 1000) |

**Example**

```
logs_read({ "service": "runtime" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [logs](https://snoozestack.com/docs/logs.md) page — the same page an agent is pointed at in the tool's own description.

`audit_list` read Recent changes to this project and who made them — from the portal, the CLI, or an AI agent (credited to its MCP token's name). Newest first. Use it to see what has already been changed before changing more, or to explain how the project got into its current state. Reads are not recorded, so this call does not appear in its own results.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `area` | string | Narrow to one part of the project One of: `auth`, `storage`, `functions`, `sites`, `domains`, `database`, `queues`, `signals`, `project` |
| `actor` | string | Narrow to where the change came from One of: `portal`, `cli`, `mcp` |

**Example**

```
audit_list()
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [portal-tour](https://snoozestack.com/docs/portal-tour.md) page — the same page an agent is pointed at in the tool's own description.

`releases_list` read The project's releases, newest first: every immutable package a `snoozestack publish` cut and deployed to production — its number, who published it, what it contains, what it dropped from the database (with how many values each dropped column or table held), and whether it is live. This reads history; it does not trigger a publish.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
releases_list()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [releases](https://snoozestack.com/docs/releases.md) page — the same page an agent is pointed at in the tool's own description.

`release_get` read One release in full: its manifest (artifact ids, a sha256 per file, the schema plan against the release production served when it was published, what it dropped, the declarations it applies, provenance), what it changed against that release, and every deployment of it.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `release` required | string | Release number ("12") or id, from releases_list |

**Example**

```
release_get({ "release": "<Release number (\"12\") or id, from releases_list>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [releases](https://snoozestack.com/docs/releases.md) page — the same page an agent is pointed at in the tool's own description.

`release_deploy` write Deploy a recorded release to production again — `snoozestack publish --release <n>`. The exact package, by artifact id, never a rebuild: the runtime and site pointers move, then the package's queues, triggers, webhooks, notification services, schedules and auth declarations are applied in the manifest's order. An older release than the live one is a rollback, recorded as one. A rollback restores code, not data: the schema stays where it is, and nothing a later release added is dropped.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `release` required | string | Release number or id from releases_list |

**Example**

```
release_deploy({ "release": "<Release number or id from releases_list>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [releases](https://snoozestack.com/docs/releases.md) page — the same page an agent is pointed at in the tool's own description.

`deployments_list` read Every deployment of this project, newest first: each publish and rollback — which release went live, from which, who did it, and how production answered afterwards.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
deployments_list()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [releases](https://snoozestack.com/docs/releases.md) page — the same page an agent is pointed at in the tool's own description.

`previews_list` read The project's previews: one per person who has run `snoozestack preview`, named after them (preview-@<handle>) — its URL, its state (building / ready / failed / expired / cleaned) and how long until it expires. A preview expires thirty minutes after it last came up.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
previews_list()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [releases](https://snoozestack.com/docs/releases.md) page — the same page an agent is pointed at in the tool's own description.

`preview_status` read One preview's status: whose it is, URL, health, seed outcome and anonymization policy, the schema plan against production, and expiry. Reading it also probes a preview that is still building.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Preview name, from previews_list |

**Example**

```
preview_status({ "name": "<Preview name, from previews_list>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [releases](https://snoozestack.com/docs/releases.md) page — the same page an agent is pointed at in the tool's own description.

`preview_delete` destroy Clean a preview up now instead of at expiry: its container, data, queues, schedule rows and secret overrides are removed. Releases are never touched.

**Access**

Removes something, and what it removes is not recoverable through the endpoint. Clients that honour the endpoint's annotations ask before running it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Preview name |

**Example**

```
preview_delete({ "name": "<Preview name>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [releases](https://snoozestack.com/docs/releases.md) page — the same page an agent is pointed at in the tool's own description.

`preview_outbox` read The email a preview's runtime tried to send — captured, never delivered — so a sign-up link or confirmation can be followed without a real inbox.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Preview name |

**Example**

```
preview_outbox({ "name": "<Preview name>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [releases](https://snoozestack.com/docs/releases.md) page — the same page an agent is pointed at in the tool's own description.

## Database

The tables the runtime built from schema.mjs — their shape, not their contents. No tool here reads or changes a row: an app reaches rows only through a function, and a developer reads them on the control plane with "snoozestack data" under their own login or a project service token.

`tables_list` read Every table the project's runtime currently holds, with its columns and row count — the shape schema.mjs produced, read back from the running database.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
tables_list()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [database](https://snoozestack.com/docs/database.md) page — the same page an agent is pointed at in the tool's own description.

## Functions, schedules & secrets

What the runtime is serving, the cron timers that invoke it, and the secret values functions read. Function code itself is published from the repo, not through a tool.

`functions_list` read The functions the project's runtime is serving right now — each with its path, auth mode (public / optional / required), declared capabilities and the secrets it may read. This is what the last `snoozestack publish` put live; the source lives in the project's repo under snoozestack/functions/<name>/.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
functions_list()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [functions](https://snoozestack.com/docs/functions.md) page — the same page an agent is pointed at in the tool's own description.

`schedules_list` read Cron schedules that invoke this project's functions, in one namespace. Only the default namespace's schedules ever auto-fire on the shared cron sweep — a preview's schedules only ever run via schedule_run.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `namespace` | string | Namespace to operate in: "default" (the live project; default when omitted) or "preview:<name>" — a person's preview, the namespace `snoozestack preview` pushed to (names from previews_list). |

**Example**

```
schedules_list()
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [functions](https://snoozestack.com/docs/functions.md) page — the same page an agent is pointed at in the tool's own description.

`schedule_create` write Invoke a function on a UTC cron timer (five fields: minute hour day month weekday). Only a "default"-namespace schedule ever auto-fires — one created in a preview namespace sits idle until schedule_run.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Schedule name |
| `function_name` required | string | Function to invoke |
| `cron` required | string | Cron expression, e.g. `"0 * * * *"` |
| `payload` | object | JSON body POSTed to the function on each run |
| `enabled` | boolean | Start enabled (default true) |
| `namespace` | string | Namespace to operate in: "default" (the live project; default when omitted) or "preview:<name>" — a person's preview, the namespace `snoozestack preview` pushed to (names from previews_list). |

**Example**

```
schedule_create({ "name": "<Schedule name>", "function_name": "<Function to invoke>", "cron": "0 * * * *" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [functions](https://snoozestack.com/docs/functions.md) page — the same page an agent is pointed at in the tool's own description.

`schedule_update` write Change a schedule's function, cron, payload, or enabled state.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Schedule name |
| `function_name` | string | Function to invoke |
| `cron` | string | Cron expression |
| `payload` | object | JSON body POSTed to the function |
| `enabled` | boolean | Enable or disable it |
| `namespace` | string | Namespace to operate in: "default" (the live project; default when omitted) or "preview:<name>" — a person's preview, the namespace `snoozestack preview` pushed to (names from previews_list). |

**Example**

```
schedule_update({ "name": "<Schedule name>" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [functions](https://snoozestack.com/docs/functions.md) page — the same page an agent is pointed at in the tool's own description.

`schedule_run` write Fire a schedule immediately, off-cycle. Returns the run's result. The one way to run a non-default-namespace schedule at all, since only default auto-fires.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Schedule name |
| `namespace` | string | Namespace to operate in: "default" (the live project; default when omitted) or "preview:<name>" — a person's preview, the namespace `snoozestack preview` pushed to (names from previews_list). |

**Example**

```
schedule_run({ "name": "<Schedule name>" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [functions](https://snoozestack.com/docs/functions.md) page — the same page an agent is pointed at in the tool's own description.

`schedule_delete` destroy Delete a schedule — its function stops firing on that timer.

**Access**

Removes something, and what it removes is not recoverable through the endpoint. Clients that honour the endpoint's annotations ask before running it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Schedule name |
| `namespace` | string | Namespace to operate in: "default" (the live project; default when omitted) or "preview:<name>" — a person's preview, the namespace `snoozestack preview` pushed to (names from previews_list). |

**Example**

```
schedule_delete({ "name": "<Schedule name>" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [functions](https://snoozestack.com/docs/functions.md) page — the same page an agent is pointed at in the tool's own description.

`secrets_list` read Names of the project's secrets and which namespaces override each — the values a function reads through its `secrets` capability. Values are never returned.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
secrets_list()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [functions](https://snoozestack.com/docs/functions.md) page — the same page an agent is pointed at in the tool's own description.

`secrets_set` write Set one or more secret values. Running runtimes pick a new value up at their next start; the declaration (which functions may read it) is project.toml's [[secrets]], not this call.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `secrets` required | object | Name → value, e.g. `{"STRIPE_KEY": "sk_live_…"}` |

**Example**

```
secrets_set({ "secrets": {"STRIPE_KEY": "sk_live_…"} })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [functions](https://snoozestack.com/docs/functions.md) page — the same page an agent is pointed at in the tool's own description.

`secrets_unset` destroy Remove a secret's value. The name stays declared in project.toml until the file changes.

**Access**

Removes something, and what it removes is not recoverable through the endpoint. Clients that honour the endpoint's annotations ask before running it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Secret name |

**Example**

```
secrets_unset({ "name": "<Secret name>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [functions](https://snoozestack.com/docs/functions.md) page — the same page an agent is pointed at in the tool's own description.

## Queues, triggers & notifications

Message queues, what runs when a message lands, the webhook URLs that enqueue one, and the push notification services a trigger can deliver through.

`queues_list` read Message queues with approximate message counts, in one namespace.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `namespace` | string | Namespace to operate in: "default" (the live project; default when omitted) or "preview:<name>" — a person's preview, the namespace `snoozestack preview` pushed to (names from previews_list). |

**Example**

```
queues_list()
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [queues](https://snoozestack.com/docs/queues.md) page — the same page an agent is pointed at in the tool's own description.

`queue_create` write Create a message queue.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Queue name |
| `namespace` | string | Namespace to operate in: "default" (the live project; default when omitted) or "preview:<name>" — a person's preview, the namespace `snoozestack preview` pushed to (names from previews_list). |

**Example**

```
queue_create({ "name": "<Queue name>" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [queues](https://snoozestack.com/docs/queues.md) page — the same page an agent is pointed at in the tool's own description.

`queue_send` write Enqueue a message — useful for smoke-testing a queue and its triggers.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Queue name |
| `body` required | string | Message body |
| `namespace` | string | Namespace to operate in: "default" (the live project; default when omitted) or "preview:<name>" — a person's preview, the namespace `snoozestack preview` pushed to (names from previews_list). |

**Example**

```
queue_send({ "name": "<Queue name>", "body": "<Message body>" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [queues](https://snoozestack.com/docs/queues.md) page — the same page an agent is pointed at in the tool's own description.

`queue_delete` destroy Delete a queue and every message in it.

**Access**

Removes something, and what it removes is not recoverable through the endpoint. Clients that honour the endpoint's annotations ask before running it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Queue name |
| `namespace` | string | Namespace to operate in: "default" (the live project; default when omitted) or "preview:<name>" — a person's preview, the namespace `snoozestack preview` pushed to (names from previews_list). |

**Example**

```
queue_delete({ "name": "<Queue name>" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [queues](https://snoozestack.com/docs/queues.md) page — the same page an agent is pointed at in the tool's own description.

`triggers_list` read Queue triggers — what runs for messages on which queue (functions, a notification service, or both), and how the last run went.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
triggers_list()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [queues](https://snoozestack.com/docs/queues.md) page — the same page an agent is pointed at in the tool's own description.

`trigger_create` write Process every message drained from a queue: invoke functions, send it as a push notification, or both. At least one destination is required. A message is removed only once every destination succeeded.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Trigger name |
| `queue_name` required | string | Queue to drain |
| `function_names` | string[] | Functions to invoke, in order |
| `notification_service` | string | Notification service to push through |

**Example**

```
trigger_create({ "name": "<Trigger name>", "queue_name": "<Queue to drain>" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [queues](https://snoozestack.com/docs/queues.md) page — the same page an agent is pointed at in the tool's own description.

`trigger_update` write Change a trigger's destinations or enabled state.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Trigger name |
| `function_names` | string[] | Replacement function list |
| `notification_service` | string | Notification service to push through |
| `enabled` | boolean | Enable or disable it |

**Example**

```
trigger_update({ "name": "<Trigger name>" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [queues](https://snoozestack.com/docs/queues.md) page — the same page an agent is pointed at in the tool's own description.

`trigger_delete` destroy Delete a queue trigger.

**Access**

Removes something, and what it removes is not recoverable through the endpoint. Clients that honour the endpoint's annotations ask before running it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Trigger name |

**Example**

```
trigger_delete({ "name": "<Trigger name>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [queues](https://snoozestack.com/docs/queues.md) page — the same page an agent is pointed at in the tool's own description.

`webhooks_list` read Public inbound URLs that write to a queue.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
webhooks_list()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [queues](https://snoozestack.com/docs/queues.md) page — the same page an agent is pointed at in the tool's own description.

`webhook_create` write Create a public URL that writes every POST straight to a queue. Add a trigger on the same queue to process the messages.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Webhook name |
| `queue_name` required | string | Queue it writes to |

**Example**

```
webhook_create({ "name": "<Webhook name>", "queue_name": "<Queue it writes to>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [queues](https://snoozestack.com/docs/queues.md) page — the same page an agent is pointed at in the tool's own description.

`webhook_delete` destroy Delete a webhook — its public URL stops accepting messages.

**Access**

Removes something, and what it removes is not recoverable through the endpoint. Clients that honour the endpoint's annotations ask before running it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Webhook name |

**Example**

```
webhook_delete({ "name": "<Webhook name>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [queues](https://snoozestack.com/docs/queues.md) page — the same page an agent is pointed at in the tool's own description.

`notification_services_list` read Push destinations a trigger can send through, with the Apple team, key and bundle IDs each one signs with (never the .p8 itself).

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
notification_services_list()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [queues](https://snoozestack.com/docs/queues.md) page — the same page an agent is pointed at in the tool's own description.

`notification_service_enable` write Turn on push notifications. Takes no credentials: APNs signs with the project's existing Apple sign-in key. That key and the App ID must both have the APNs capability ticked in Apple's developer portal, which only the account holder can do.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` | string | Service name (default "apple") |

**Example**

```
notification_service_enable()
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [queues](https://snoozestack.com/docs/queues.md) page — the same page an agent is pointed at in the tool's own description.

`notification_service_delete` destroy Turn off a push destination. Triggers using it stop sending; the Apple key itself is untouched.

**Access**

Removes something, and what it removes is not recoverable through the endpoint. Clients that honour the endpoint's annotations ask before running it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `name` required | string | Service name |

**Example**

```
notification_service_delete({ "name": "<Service name>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [queues](https://snoozestack.com/docs/queues.md) page — the same page an agent is pointed at in the tool's own description.

`push_devices` read Registered push devices: active/retired counts, a breakdown by APNs environment, and recent registrations (tokens truncated).

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
push_devices()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [queues](https://snoozestack.com/docs/queues.md) page — the same page an agent is pointed at in the tool's own description.

## Storage

Buckets, the objects in them, and signed URLs for reaching private ones.

`buckets_list` read Storage buckets and whether each is public, in one namespace.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `namespace` | string | Namespace to operate in: "default" (the live project; default when omitted) or "preview:<name>" — a person's preview, the namespace `snoozestack preview` pushed to (names from previews_list). |

**Example**

```
buckets_list()
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [storage](https://snoozestack.com/docs/storage.md) page — the same page an agent is pointed at in the tool's own description.

`objects_list` read Files in a bucket, optionally under a path prefix.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `bucket` required | string | Bucket name |
| `prefix` | string | Path prefix, e.g. `"avatars/"` |
| `namespace` | string | Namespace to operate in: "default" (the live project; default when omitted) or "preview:<name>" — a person's preview, the namespace `snoozestack preview` pushed to (names from previews_list). |

**Example**

```
objects_list({ "bucket": "<Bucket name>" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [storage](https://snoozestack.com/docs/storage.md) page — the same page an agent is pointed at in the tool's own description.

`object_upload` write Upload a file to a bucket. Pass base64 for binary content.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `bucket` required | string | Bucket name |
| `path` required | string | Object key, e.g. `"avatars/me.png"` |
| `content` required | string | File contents |
| `encoding` | string | How `content` is encoded (default utf8) One of: `utf8`, `base64` |
| `contentType` | string | MIME type, e.g. `"image/png"` |
| `namespace` | string | Namespace to operate in: "default" (the live project; default when omitted) or "preview:<name>" — a person's preview, the namespace `snoozestack preview` pushed to (names from previews_list). |

**Example**

```
object_upload({ "bucket": "<Bucket name>", "path": "avatars/me.png", "content": "<File contents>" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [storage](https://snoozestack.com/docs/storage.md) page — the same page an agent is pointed at in the tool's own description.

`object_delete` destroy Delete one file from a bucket.

**Access**

Removes something, and what it removes is not recoverable through the endpoint. Clients that honour the endpoint's annotations ask before running it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `bucket` required | string | Bucket name |
| `key` required | string | Object key |
| `namespace` | string | Namespace to operate in: "default" (the live project; default when omitted) or "preview:<name>" — a person's preview, the namespace `snoozestack preview` pushed to (names from previews_list). |

**Example**

```
object_delete({ "bucket": "<Bucket name>", "key": "<Object key>" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [storage](https://snoozestack.com/docs/storage.md) page — the same page an agent is pointed at in the tool's own description.

`object_sign_url` read A time-limited signed URL for one object in a private bucket.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `bucket` required | string | Bucket name |
| `key` required | string | Object key |
| `namespace` | string | Namespace to operate in: "default" (the live project; default when omitted) or "preview:<name>" — a person's preview, the namespace `snoozestack preview` pushed to (names from previews_list). |

**Example**

```
object_sign_url({ "bucket": "<Bucket name>", "key": "<Object key>" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [storage](https://snoozestack.com/docs/storage.md) page — the same page an agent is pointed at in the tool's own description.

## Websites

Static sites served on the project host: uploading files, publishing a version, and choosing which one is live.

`sites_list` read Published static websites with their file counts and URLs.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
sites_list()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [websites](https://snoozestack.com/docs/websites.md) page — the same page an agent is pointed at in the tool's own description.

`site_files` read Every published file of one site with its content hash — the manifest a sync diffs against.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `site` required | string | Site name |

**Example**

```
site_files({ "site": "<Site name>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [websites](https://snoozestack.com/docs/websites.md) page — the same page an agent is pointed at in the tool's own description.

`site_upload_file` write Stage one file for a site. Upload each file, then call site_publish once to create a version — previewable immediately, never live on its own: a site goes live only as part of a release (snoozestack publish).

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `site` required | string | Site name |
| `path` required | string | Site-relative path, e.g. `"index.html"` |
| `content` required | string | File contents |
| `encoding` | string | How `content` is encoded (default utf8) One of: `utf8`, `base64` |

**Example**

```
site_upload_file({ "site": "<Site name>", "path": "index.html", "content": "<File contents>" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [websites](https://snoozestack.com/docs/websites.md) page — the same page an agent is pointed at in the tool's own description.

`site_delete_files` destroy Remove specific files from a site — the prune half of a publish.

**Access**

Removes something, and what it removes is not recoverable through the endpoint. Clients that honour the endpoint's annotations ask before running it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `site` required | string | Site name |
| `paths` required | string[] | Files to remove |

**Example**

```
site_delete_files({ "site": "<Site name>", "paths": ["<Files to remove>"] })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [websites](https://snoozestack.com/docs/websites.md) page — the same page an agent is pointed at in the tool's own description.

`site_delete` destroy Delete a whole site. It stops serving immediately.

**Access**

Removes something, and what it removes is not recoverable through the endpoint. Clients that honour the endpoint's annotations ask before running it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `site` required | string | Site name |

**Example**

```
site_delete({ "site": "<Site name>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [websites](https://snoozestack.com/docs/websites.md) page — the same page an agent is pointed at in the tool's own description.

`site_set_primary` write Serve this site at the bare project host root. It must already be published.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `site` required | string | Site name |

**Example**

```
site_set_primary({ "site": "<Site name>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [websites](https://snoozestack.com/docs/websites.md) page — the same page an agent is pointed at in the tool's own description.

`site_publish` write Turn whatever was staged with site_upload_file/site_delete_files into a new version. Returns a preview URL — the version is viewable there immediately but does not go live: a site goes live only as part of a release (snoozestack publish, or release_deploy of a recorded one).

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `site` required | string | Site name |

**Example**

```
site_publish({ "site": "<Site name>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [websites](https://snoozestack.com/docs/websites.md) page — the same page an agent is pointed at in the tool's own description.

`site_versions` read Version history for a site — id, created_at, size, status, and which one (if any) is live.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `site` required | string | Site name |

**Example**

```
site_versions({ "site": "<Site name>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [websites](https://snoozestack.com/docs/websites.md) page — the same page an agent is pointed at in the tool's own description.

## Domains

Custom domains, their DNS records, and the CDN distributions in front of them.

`domains_list` read Custom domains connected to this project, with their nameservers and certificate status.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
domains_list()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [domains](https://snoozestack.com/docs/domains.md) page — the same page an agent is pointed at in the tool's own description.

`domain_connect` write Connect a custom domain: creates its hosted zone and certificate. Point the registrar at the returned nameservers.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `domain` required | string | Apex domain, e.g. `example.com` |

**Example**

```
domain_connect({ "domain": "example.com" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [domains](https://snoozestack.com/docs/domains.md) page — the same page an agent is pointed at in the tool's own description.

`domain_disconnect` destroy Disconnect a custom domain and tear down its zone.

**Access**

Removes something, and what it removes is not recoverable through the endpoint. Clients that honour the endpoint's annotations ask before running it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `domain` required | string | Domain to remove |

**Example**

```
domain_disconnect({ "domain": "<Domain to remove>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [domains](https://snoozestack.com/docs/domains.md) page — the same page an agent is pointed at in the tool's own description.

`domain_records_list` read DNS records in a connected domain's hosted zone.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `domain` required | string | Connected domain |

**Example**

```
domain_records_list({ "domain": "<Connected domain>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [domains](https://snoozestack.com/docs/domains.md) page — the same page an agent is pointed at in the tool's own description.

`domain_record_upsert` write Create or replace a DNS record in a connected domain's zone.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `domain` required | string | Connected domain |
| `name` required | string | Record name, e.g. `mail.example.com` |
| `type` required | string | Record type, e.g. `A, CNAME, TXT, MX` |
| `values` required | string[] | Record values |
| `ttl` | integer | TTL in seconds (default 300) |

**Example**

```
domain_record_upsert({ "domain": "<Connected domain>", "name": "mail.example.com", "type": "A", "values": ["<Record values>"] })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [domains](https://snoozestack.com/docs/domains.md) page — the same page an agent is pointed at in the tool's own description.

`domain_record_delete` destroy Delete a DNS record from a connected domain's zone.

**Access**

Removes something, and what it removes is not recoverable through the endpoint. Clients that honour the endpoint's annotations ask before running it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `domain` required | string | Connected domain |
| `name` required | string | Record name |
| `type` required | string | Record type |

**Example**

```
domain_record_delete({ "domain": "<Connected domain>", "name": "<Record name>", "type": "<Record type>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [domains](https://snoozestack.com/docs/domains.md) page — the same page an agent is pointed at in the tool's own description.

`distributions_list` read CDN distributions attaching custom domains to this project's websites and API.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
distributions_list()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [domains](https://snoozestack.com/docs/domains.md) page — the same page an agent is pointed at in the tool's own description.

`distribution_create` write Attach a custom domain (or subdomain) to a published site or to the project API.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `domain` required | string | Connected apex domain |
| `target_kind` required | string | What the domain should serve One of: `site` |
| `site` | string | Site name when target_kind is "site" |
| `subdomain` | string | Subdomain label, e.g. `"app"; omit for the apex` |

**Example**

```
distribution_create({ "domain": "<Connected apex domain>", "target_kind": "site" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [domains](https://snoozestack.com/docs/domains.md) page — the same page an agent is pointed at in the tool's own description.

`distribution_delete` destroy Detach a distribution: the domain stops serving and its alias records go away.

**Access**

Removes something, and what it removes is not recoverable through the endpoint. Clients that honour the endpoint's annotations ask before running it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `id` required | string | Distribution id from distributions_list |

**Example**

```
distribution_delete({ "id": "<Distribution id from distributions_list>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [domains](https://snoozestack.com/docs/domains.md) page — the same page an agent is pointed at in the tool's own description.

## Authentication

How users sign in: the identity service, sign-in providers, redirect URLs, email templates, and the user list itself.

`identity_config_get` read The redirect-URL allowlist and OAuth provider declarations for this project's hosted application-identity service (magic-link + OAuth sign-in behind the whoami cookie) — what the last `snoozestack publish` applied from project.toml's [auth] table. Distinct from auth_config_get, which covers the separate GoTrue-backed auth service.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
identity_config_get()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [authentication](https://snoozestack.com/docs/authentication.md) page — the same page an agent is pointed at in the tool's own description.

`auth_config_get` read Auth URL configuration and which sign-in providers are on.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
auth_config_get()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [authentication](https://snoozestack.com/docs/authentication.md) page — the same page an agent is pointed at in the tool's own description.

`auth_config_update` write Set the site URL and the redirect URLs auth is allowed to send users back to. Restarts the auth service.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `siteUrl` | string | Where auth redirects land by default |
| `additionalRedirectUrls` | string[] | Other allowed redirect URLs |

**Example**

```
auth_config_update()
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [authentication](https://snoozestack.com/docs/authentication.md) page — the same page an agent is pointed at in the tool's own description.

`auth_provider_update` write Turn a sign-in provider on or off. For google, pass the OAuth client id; the secret can be omitted once one is stored. For apple, pass the services id plus the team id, key id and .p8, and a clientSecret from auth_apple_secret_generate.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `provider` required | string | Provider to configure One of: `email`, `google`, `apple` |
| `enabled` required | boolean | On or off |
| `clientId` | string | Google OAuth client id |
| `clientSecret` | string | Google OAuth client secret, or generated Apple client secret |
| `servicesId` | string | Apple services id — the web client the secret is signed for |
| `bundleIds` | string | Bundle ids of native apps that sign in by ID token, comma-separated |
| `secretExpiresAt` | string | Expiry of the Apple client secret, as returned by auth_apple_secret_generate |
| `teamId` | string | Apple developer team id |
| `keyId` | string | Apple signing key id |
| `privateKey` | string | Contents of the Apple .p8 signing key; stored so the secret can be regenerated |
| `skipNonceCheck` | boolean | Google only: accept ID tokens with any nonce (needed by some native flows) |

**Example**

```
auth_provider_update({ "provider": "email", "enabled": true })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [authentication](https://snoozestack.com/docs/authentication.md) page — the same page an agent is pointed at in the tool's own description.

`auth_apple_secret_generate` write Sign an Apple client secret from the project's .p8 key and return it with its expiry — Apple's secret is a token that expires after six months, not a fixed string. Saves nothing: pass the result to auth_provider_update. Services id, team id, key id and private key fall back to what's already stored.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `servicesId` required | string | Services id the secret is signed for — never a native bundle id |
| `teamId` | string | Apple developer team id |
| `keyId` | string | Apple signing key id |
| `privateKey` | string | Contents of the Apple .p8 signing key |

**Example**

```
auth_apple_secret_generate({ "servicesId": "<Services id the secret is signed for — never a native bundle id>" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [authentication](https://snoozestack.com/docs/authentication.md) page — the same page an agent is pointed at in the tool's own description.

`auth_provider_delete` destroy Remove a provider's stored credentials entirely.

**Access**

Removes something, and what it removes is not recoverable through the endpoint. Clients that honour the endpoint's annotations ask before running it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `provider` required | string | Provider to remove One of: `google`, `apple` |

**Example**

```
auth_provider_delete({ "provider": "google" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [authentication](https://snoozestack.com/docs/authentication.md) page — the same page an agent is pointed at in the tool's own description.

`auth_users_list` read End users of this project's auth service, with sign-in and confirmation timestamps.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
auth_users_list()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [authentication](https://snoozestack.com/docs/authentication.md) page — the same page an agent is pointed at in the tool's own description.

`auth_user_set_banned` write Ban or unban one end user.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `id` required | string | User id |
| `banned` required | boolean | Banned or not |

**Example**

```
auth_user_set_banned({ "id": "<User id>", "banned": true })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [authentication](https://snoozestack.com/docs/authentication.md) page — the same page an agent is pointed at in the tool's own description.

`auth_user_delete` destroy Delete an end user account.

**Access**

Removes something, and what it removes is not recoverable through the endpoint. Clients that honour the endpoint's annotations ask before running it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `id` required | string | User id |

**Example**

```
auth_user_delete({ "id": "<User id>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [authentication](https://snoozestack.com/docs/authentication.md) page — the same page an agent is pointed at in the tool's own description.

`auth_user_send_email` write Send an existing user their sign-in link — which is also how a forgotten password is recovered. There is no invite or re-confirmation: accounts exist only because someone signed up.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `type` required | string | Which email to send One of: `recovery` |
| `email` required | string | Recipient address |

**Example**

```
auth_user_send_email({ "type": "recovery", "email": "<Recipient address>" })
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [authentication](https://snoozestack.com/docs/authentication.md) page — the same page an agent is pointed at in the tool's own description.

`auth_emails_get` read The project's auth email templates, the from address, and whether signups require email confirmation.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
auth_emails_get()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [authentication](https://snoozestack.com/docs/authentication.md) page — the same page an agent is pointed at in the tool's own description.

`auth_emails_update` write Override auth email templates and/or the email-confirmation requirement. A template set to null resets to the default.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `emailConfirmations` | boolean | Require email confirmation on signup |
| `templates` | object | Type → { subject, body } or null, e.g. `{"invite": {"subject": "…", "body": "<p>…</p>"}}` |

**Example**

```
auth_emails_update()
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [authentication](https://snoozestack.com/docs/authentication.md) page — the same page an agent is pointed at in the tool's own description.

`auth_landing_config_get` read Where the hosted password page sends users instead of rendering its own form.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
auth_landing_config_get()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [authentication](https://snoozestack.com/docs/authentication.md) page — the same page an agent is pointed at in the tool's own description.

`auth_landing_config_update` write Set where the hosted password page hands off to instead of rendering its own form. Pass null for a field to clear that override.

**Access**

Creates or updates something in the project. Reversible by a further change.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `mobileUrl` | string | Deep link for mobile clients |
| `webUrl` | string | Where browsers go instead of the hosted page |

**Example**

```
auth_landing_config_update()
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [authentication](https://snoozestack.com/docs/authentication.md) page — the same page an agent is pointed at in the tool's own description.

## Signals

Product analytics — the events, users and metrics the SDKs report. Read-only.

`signals_overview` read Product-analytics aggregates for a time range: totals, per-bucket series and the top events.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `range` | string | Time range (default 7d) One of: `24h`, `7d`, `30d`, `90d` |

**Example**

```
signals_overview()
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [signals](https://snoozestack.com/docs/signals.md) page — the same page an agent is pointed at in the tool's own description.

`signals_events` read The newest-first stream of raw signals, filterable by type, name, user and free text. `type` defaults to "event" (product analytics); set it to log/metric/trace/audit to read those instead — they don't carry a user (distinct_id is event-only).

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `type` | string | Signal type (default event) One of: `event`, `log`, `metric`, `trace`, `audit` |
| `range` | string | Time range (default 7d) One of: `24h`, `7d`, `30d`, `90d` |
| `events` | string[] | Only these names |
| `distinct_id` | string | Only this user's events (type=event only) |
| `q` | string | Free-text match on name or user |
| `before_ts` | string | Page back: `ts` of the last signal you saw |
| `before_id` | string | Page back: `id` of the last signal you saw |

**Example**

```
signals_events()
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [signals](https://snoozestack.com/docs/signals.md) page — the same page an agent is pointed at in the tool's own description.

`signals_users` read User profiles derived from events.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `q` | string | Search by user id or trait |
| `offset` | integer | Row offset for paging |

**Example**

```
signals_users()
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [signals](https://snoozestack.com/docs/signals.md) page — the same page an agent is pointed at in the tool's own description.

`signals_meta` read Event names and property keys seen in a range — the vocabulary available for filters. With `property` set, returns that key's top values instead.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `range` | string | Time range (default 7d) One of: `24h`, `7d`, `30d`, `90d` |
| `property` | string | Property key to list values for |

**Example**

```
signals_meta()
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [signals](https://snoozestack.com/docs/signals.md) page — the same page an agent is pointed at in the tool's own description.

## Documentation & versions

These docs, served over the same connection, plus the currently published CLI and SDK versions. Read-only, and about snoozestack rather than the project.

`docs_index` read The snoozestack documentation table of contents: every page with its summary, its sections, and the management tools it explains. Read this first when you need to know how a feature is meant to be used, or which tool to reach for.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
docs_index()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [mcp](https://snoozestack.com/docs/mcp.md) page — the same page an agent is pointed at in the tool's own description.

`docs_read` read Read a documentation page in full, or one section of it. Covers the concepts, the design patterns snoozestack expects, and worked examples — the reasoning behind an operation rather than just its arguments.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `slug` required | string | Page slug from docs_index, e.g. `"functions" or "permissions"` |
| `section` | string | Section id from the page's `sections` list; omit for the whole page |

**Example**

```
docs_read({ "slug": "functions" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [mcp](https://snoozestack.com/docs/mcp.md) page — the same page an agent is pointed at in the tool's own description.

`docs_search` read Search the documentation for a term and get back the pages and sections that discuss it, with a snippet of each. Use it when you know the concept but not which page covers it.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

| Parameter | Type | Description |
| --- | --- | --- |
| `query` required | string | What to look for, e.g. `"committed function" or "signed url"` |
| `limit` | integer | Maximum hits to return (default 8) |

**Example**

```
docs_search({ "query": "committed function" })
```

Shown with the required arguments only. Anything not required is optional and defaults as its description says.

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [mcp](https://snoozestack.com/docs/mcp.md) page — the same page an agent is pointed at in the tool's own description.

`sdk_versions` read The currently published versions of the snoozestack CLI and client SDKs, with the exact install command for each. Packages are served from version-pinned URLs rather than a registry, so check here before writing an install line.

**Access**

Only observes. Nothing about the project changes when an agent calls it.

**Inputs**

None. The project is never an argument — it comes from the token — so the call is bare.

**Example**

```
sdk_versions()
```

**Returns**

The same JSON the [Management API](https://snoozestack.com/docs/management-api.md) route behind this tool returns — the tool is a thin wrapper over it, not a separate implementation. A refused call comes back as that route's own error message.

Explained on the [installation](https://snoozestack.com/docs/installation.md) page — the same page an agent is pointed at in the tool's own description.

### Where this list comes from

The page is generated, not written. The endpoint's tool table — the one file that declares every tool, its description and its argument schema, and the one `tools/list` is answered from — is flattened into the data this page renders, and the portal's test suite compares the two on every run. A tool added, renamed or re-described without regenerating this page fails those tests, so what you read here is what an agent is offered, described in the same words the agent reads.

The access type is the tool's own `readOnlyHint` / `destructiveHint` annotation, so it can't disagree with what a client is told. To see the live catalogue for a specific project, including any schema detail this page abbreviates, ask the endpoint directly:

```bash title="terminal"
curl -s https://snoozestack.com/api/mcp/<ref> \
  -H "Authorization: Bearer sb_mcp_..." \
  -H "content-type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

Everything an agent does with these tools is recorded in the project's audit log, credited to the token's name — `audit_list` above reads it, and so does the Audit page in the console. Reads are not recorded; changes and deletions are.